HIPAA right of access fines seem to be growing on trees these days. The Department of Health and Human Services’ (HHS) Office for Civil Rights (OCR) has announced its tenth HIPAA right of access settlement this year. More details are discussed below.
Riverside Psychiatric Medical Group HIPAA Right of Access Settlement
Riverside Psychiatric Medical Group (RPMG) has agreed to pay the HHS’ OCR a $25,000 fine, implement a corrective action plan, and is subject to two years of monitoring to settle a HIPAA violation. But what led to the HIPAA right of access settlement?
OCR received a complaint from a patient in March 2019 alleging that RPMG failed to provide her with access to her medical records. Starting in February 2019, the patient issued several requests for her medical records but RPMG failed to provide her with a copy of her records. Upon receiving the complaint, OCR provided RPMG with technical assistance to comply with the right of access standard. However, in April 2019, OCR received a second complaint that RPMG had still not provided the patient access to her medical records.
After the second complaint, OCR conducted an investigation into the complaint and found that RPMG had violated the HIPAA right of access. Apparently RPMG was under the impression that since the records the patient requested included psychotherapy notes, they did not have to provide the patient access to her records.
Although HIPAA doesn’t require providers to grant patient access to psychotherapy notes, it does require them to (1) to provide requestors a written explanation when it denies any records request in whole or in part (which RPMG did not do), and (2) to provide the individual access to his or her medical records other than psychotherapy notes (and information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding).
In October 2020, the patient finally received the copies of the medical records that she requested, excluding the psychotherapy notes. “When patients request copies of their health records, they must be given a timely response, not a run-around,” said OCR Director Roger Severino.
To read more about the HIPAA right of access settlement, please click here.
What is the HIPAA Right of Access?
The right of access requires healthcare providers to provide requested records to patients, or their personal representative, within 30 days of the request. Records must be provided in the format requested (i.e., paper, electronic medical records, etc.) unless the provider cannot reasonably do so, in which case an alternative format is acceptable. Under the right of access, providers can charge a cost-based fee for access to records, such as if the patient requests records to be provided on a CD, the provider can charge for the cost of the CD. As mentioned above, providers are not required to provide patients access to psychotherapy notes.
